ATTORNEY DOCKET NO. 
063170.6605 



18 



PATENT APPLICATION 
09/862,801 



REMARKS 

This Application has been carefully reviewed in light of the Final Office Action 
mailed July 28, 2005 ("Office Action"). Claims 1-32 are pending in the present 
application and currently stand rejected. 

Section 103 Rejections 

Claims 1-32 were rejected under 35 U.S.C. § 103(a) as being unpatentable over 
U.S. Patent No. 6,519,703 issued to Joyce ("Joyce") in view of an Alleged Admission of 
Prior Art (AAPA). 1 Applicants respectfully traverse the rejections. 

Independent Claim 1 is allowable because the proposed combination of Joyce and 
AAPA fails to di close at least the following limitations: 

selecting a fastest one of the malicious code detection methods; 

analyzing computer code for malicious code using the selected malicious 
code detection method; 

determining a probability of accuracy of a result of the analysis; 

selecting a next fastest one of the malicious code detection methods and 
repeating the analyzing and determining steps, if the probability of accuracy is 
below a predetermined level 

(Emphasis Added.) Of the above limitations, the Final Office Action acknowledged that 
Joyce did not disclose, teach, or suggest "selecting a fastest one of the malicious code 
detection methods, analyzing computer code for malicious code using the selected 
malicious code detection method; selecting a next fastest one of the malicious code 
detection method." Office Action, Page 4. Rather, the Office Action relies on the AAPA 
to disclose these limitations. However, this is incorrect. Assuming for the sake of 
argument that the AAPA is prior art, Applicants submit that the AAPA does not disclose 
selecting a fastest one of the malicious code detection methods, analyzing computer code 
for malicious code using the selected malicious code detection method, and selecting a 
next fastest one of the malicious code detection methods. Rather, the AAPA simply 
introduces the concept that "[different hueristic detection methods may require different 
amounts of time and/or utilize varying amount of computer resources." Page 2 of 

1 The AAPA cited in the Office Action is the section entitled "Description of the Related Art" in the 
Application. 
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Application. This recitation simply does not disclose the above-referenced limitation in 
Independent Claim 1. With respect to these limitations, the Office Action simply states: 

. . . AAPA disclose at least some of the malicious detection methods 
require different amounts of time to analyze for malicious code; selecting 
a fastest one of the malicious code detection methods, analyzing 
computer code for malicious code using the selected malicious code 
detection method; selecting a next fastest one of the malicious code 
detection methods (see page 1 and 2 of specification). 

(Office Action, Page 4.) But, as described above, all of these limitations are not disclosed 
in the AAPA. Accordingly, for at least this reason, Applicants submit that Independent 
Claim 1 and its dependents, Claims 2-6, are allowable. Independent Claims 7, 13, 19, 25, 
26, 27, 28, 29, 30, 31, and 32 are allowable for analogous reasons as are their dependents, 
Claims 8-12, 14-18, and 20-24. 

Independent Claim 1 is further allowable because the proposed combination of 
Joyce and AAPA fails to disclose repeating the analyzing and determining steps if the 
probability of accuracy is below a predetermined level. With regards to this limitation, the 
Final Office Action cites Column 2, lines 42-65 and the Abstract of Joyce. However, this 
is incorrect. In these sections, Joyce does not disclose repeating the analyzing and 
determining steps . With reference to Joyce 's FIGURE 1 and Column 2, Joyce describes a 
system in which data packets 22 undergo a hueristic analysis stage 16. Based upon the 
hueristic analysis stage 16, the data packets 22 are assigned a confidence level. If they 
have a "high-confidence," they are released to a traditional firewall rule base 12. If they 
have a "marginal-confidence," they are release into a more complex firewall rules base 14. 
If they have a "poor-confience," they are shunted out of firewall 10A. In this portion of 
Joyce, no disclosure is made as to an additional determination of a probability of accuracy 
of a result of an additional analysis. Accordingly, for at least this additional reason, 
Applicants submit that Independent Claim 1 and its dependents, Claims 2-6, when viewed 
as a whole are allowable. Independent Claims 7, 13, 19, 25, 26, 27, 28, 29, 30, 31, and 32 
are allowable for analogous reasons as are their dependents, Claims 8-12, 14-18, and 20- 
24. 
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Notwithstanding the above reasons for allowance, many of the dependent claims 
are also allowable because the combined references fails to teach or suggest the additional 
limitation or limitations recited by respective dependent claims. An example is described 
below. 

Claim 5 is allowable because the combined references fail to disclose prompting a 
user to input a value to be used as the predetermined level. With regards to this limitation, 
the Final Office Action merely points to Joyce, Column 2, lines 42-65. However, this 
portion of Joyce makes no disclosure of prompting a user, let alone, prompting a user to 
input a value to be used as the predetermined level. For at least this additional reason, 
Claim 5 and its dependent, Claim 6, are allowable. Claims 11, 17, 23, and their 
dependents, Claims 12, 18, and 24 are allowable for analogous reasons. 

Applicant's additionally challenge the Final Office Action's alleged motivation to 
combine and modify features from the proposed references. The entirety of this alleged 
motivation is a follows: 

It would have been obvious to one of ordinary skill in the art at the time 
the invention was made to utilize AAPA's prior art disclosure in Joyce's 
Heuristic packet filter analysis in order to provide different methods based 
on Hueristic 's logic based rules , 

(Office Action, Page 4, emphasis added.) The Final Office Action acknowledges that 
Joyce does not disclose "wherein at least some of the malicious code detection methods 
require different amounts of time to analyze for code, selecting a fastest one of the 
malicious code detection methods, analyzing computer code for malicious code using the 
selected malicious code detection method; selecting a next fastest one of the malicious 
code detection method." Office Action, Page 4. Accordingly, at a minimum, prior art 
references would need to suggest a desirability in combining the above limitations with 
Joyce. The conclusory reasoning provided above simply does not meet this requirement. 
Accordingly, the required evidence of a motivation to combine and/or modify prior art 
references is lacking. See Ex Part O 'Donnell, Appeal No. 2004-042 1 (The Board found 
that the Examiner's reason, "it would have been within the scope of one of ordinary skill 
in the art to combine the teachings of applicant's admitted prior art and [patent reference] 
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to achieve further corrosion resistance," an inadequate reason as to why there is a 
motivation to combine the references.). 

To this end, a reminder is given that the mere fact that references can be combined 
or modified does not render the resultant combination obvious unless the prior art also 
suggests the desirability of the combination. See, e.g., In Re Jones, 958 F.2d 347, 351, 21 
U.S.P.Q.2d 1941, 1944 (Fed. Cir. 1992) ("Conspicuously missing from this record is any 
evidence, other than the PTO's speculation (if that can be called evidence) that one of 
ordinary skill in the herbicidal art would have been motivated to make the modification of 
the prior art salts necessary to arrive at the claimed. ..salt."). Further, "[t]he factual inquiry 
whether to combine references must be thorough and searching." (In re Sang-Su Lee, 277 
F.3d 1338, 1343). "[An] examiner's conclusory statements ... do not adequately address 
the issue of motivation to combine." Id. Furthermore, simple hindsight speculation that 
"it would have been obvious" to make the proposed combination is insufficient under 
M.P.E.P. 2 guidelines and governing Federal Circuit case law. 3 Moreover, such statements 
and assumptions are inadequate to support a finding of motivation, which is a factual 
question that cannot be resolved on "subjective belief and unknown authority." 4 

Should a rejection based on any of the above asserted rejections be maintained, 
Applicants respectfully request appropriate evidentiary support. Additionally, if the 
Examiner is relying upon "common knowledge" or "well known" principles to establish 



2 See, e.g., M.P.E.P. §2145 X.C. ("The Federal Circuit has produced a number of decisions overturning 
obviousness rejections due to a lack of suggestion in the prior art of the desirability of combining 
references.'*). 

3 For example, in In re Dembiczak, 175 F.3d 994 (Fed. Cir. 1999), the Federal Circuit reversed a finding of 
obviousness by the Board of Patent Appeals and Interferences, explaining that evidence of a suggestion, 
teaching, or motivation to combine is essential to avoid impermissible hindsight reconstruction of an 
applicant's invention: 

Our case law makes clear that the best defense against the subtle but 
powerful attraction of hindsight obviousness analysis is rigorous 
application of the requirement for a showing of the teaching or motivation 
to combine prior art references. Combining prior art references without 
evidence of such a suggestion, teaching, or motivation simply takes the 
inventor's disclosure as a blueprint for piecing together the prior art to 
defeat patentability — the essence of hindsight. 

175 F.3d at 999 (quoting JV.L. Gore & Assoc., Inv. v. Garlock, Inc., 721 F.2d 1540, 1553 (Fed. Cir. 1983)) 

(emphasis added) (citations omitted). 

4 See In re Lee, 111 F.3d 1338, 1344 (Fed. Cir. 2002). 
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the rejection, Applicants request that a reference be provided in support of this position 
pursuant to M.P.E.P. § 2144.03. Furthermore, to the extent that the Examiner maintains 
any rejection based on an "Official Notice" or other information within the Examiner's 
personal knowledge, Applicants respectfully request that the Examiner cite a reference as 
documentary evidence in support of this position or provide an affidavit in accordance 
with M.P.E.P. § 2144.03 and 37 C.F.R. 1.104(d)(2). 



DAL0 1:872200.1 



ATTORNEY DOCKET NO. 
063170.6605 



PATENT APPLICATION 
09/862,801 



23 



CONCLUSION 



Applicants have made an earnest attempt to place this case in condition for 
allowance. For the foregoing reasons, and for other reasons clearly apparent, Applicants 
respectfully request full allowance of all pending claims. 

If the Examiner feels that a telephone conference would advance prosecution of 
this Application in any manner, the Examiner is invited to contact Brad P. Williams, 
Attorney for Applicants, at the Examiner's convenience at (214) 953-6447. 

Although no fees are believed due, the Commissioner is hereby authorized to 
charge any fees or credit any overpayments to Deposit Account No. 02-0384 of Baker 
Botts L.L.P. 



Respectfully submitted, 

BAKER BOTTS L.L.P. 
Attorneys for Applicants 




Date: 




Correspondence Address: 



at Customer No. 
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